CVE-2020-9087 Information disclosure in Taurus-AL00A

Medium 5.5 Published 12 Oct 2020 Updated 4 Aug 2024

An authenticated local attacker can exploit an out-of-bounds read in the XFRM module to leak sensitive information.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-9087?

CVE-2020-9087 is a medium-severity vulnerability in Taurus-AL00A, published on 12 Oct 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Taurus-AL00A version 10.0.0.1(C00E1R1P1) has an out-of-bounds read vulnerability in XFRM module. An authenticated, local attacker may perform a specific operation to exploit this vulnerability. Due to insufficient validation of the parameters, which may be exploited to cause information leak.

Weakness: CWE-125

Which versions are affected by CVE-2020-9087?

It affects 1 product.

Products include Huawei Taurus-Al00a Firmware.

How do I fix CVE-2020-9087?

No fix has been published for CVE-2020-9087 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-9087 being exploited?

There is no known exploitation of CVE-2020-9087 in the wild and no public exploit code.

Sources

Also known as GHSA-cq5p-pr6h-gvqr.